DNS Challenge fails for real run, but works without error with dry-run

[johnfwebdev]

I've done this with the standard 10 second wait, and the 60 second wait, and the results are the same. I did this a few days ago, but had neglected to include both johnwillneverdie.com and *.johnwillneverdie.com so I'm having to reissue it with both to make it work on my server. However now it's failing. I already tried it recreate the Digital Ocean API keys to eliminate any issues there.

My domain is: johnwillneverdie.com

I ran this command: sudo certbot certonly --dns-digitalocean --dns-digitalocean-credentials certbot-creds.ini --dns-digitalocean-propagation-seconds 60 --agree-tos --no-eff-email -m john.f.webdev@gmail.com -d johnwillneverdie.com -d *.johnwillneverdie.com --dry-run

And the real one:

sudo certbot certonly --dns-digitalocean --dns-digitalocean-credentials certbot-creds.ini --dns-digitalocean-propagation-seconds 60 --agree-tos --no-eff-email -m john.f.webdev@gmail.com -d johnwillneverdie.com -d *.johnwillneverdie.com

It produced this output:

Plugins selected: Authenticator dns-digitalocean, Installer None
Requesting a certificate for johnwillneverdie.com and *.johnwillneverdie.com
Performing the following challenges:
dns-01 challenge for johnwillneverdie.com
Waiting 60 seconds for DNS changes to propagate
Waiting for verification...
Challenge failed for domain johnwillneverdie.com
dns-01 challenge for johnwillneverdie.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

• The following errors were reported by the server:

  Domain: johnwillneverdie.com
  Type: unauthorized
  Detail: Incorrect TXT record
  "HnqeNJZrtIcdfmo68Qo3qbWU97aYzCFK_mEi9KXw7xE" (and 1 more) found at
  _acme-challenge.johnwillneverdie.com

  To fix these errors, please make sure that your domain name was
  entered correctly and the DNS A/AAAA record(s) for that domain
  contain(s) the right IP address.

My web server is (include version): nginx (however this isn't the issue.

The operating system my web server runs on is (include version): debian

My hosting provider, if applicable, is: Digital Ocean

I can login to a root shell on my machine (yes or no, or I don't know): Yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.12.0

[rg305]

Hi @johnfwebdev and welcome to the LE community forum

@johnfwebdev

--dns-digitalocean-propagation-seconds 60

Try increasing the delay to 300.
[which should give you plenty of time to check for the entry being updated/visible from the Internet]

[johnfwebdev]

I'll give it a shot @rg305, I'll let you know how it goes. Thanks!

[johnfwebdev]

Worked like a charm TY!